CVE-2008-5278: Cross-site scripting (XSS) vulnerability

Debian Bug report logs - #507193
CVE-2008-5278: Cross-site scripting (XSS) vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2008-5278: Cross-site scripting (XSS) vulnerability

Date: Sat, 29 Nov 2008 00:53:25 +0100

Package: wordpress
Severity: important
Tags: security, patch

Hi,

the following CVE (Common Vulnerabilities & Exposures) id was
published for wordpress.

CVE-2008-5278[0]:
Cross-site scripting (XSS) vulnerability in the self_link function in
in the RSS Feed Generator (wp-includes/feed.php) for WordPress before
2.6.5 allows remote attackers to inject arbitrary web script or HTML
via the Host header (HTTP_HOST variable).

The upstream patch is here[1], look at the diff in wp-includes/feed.php.
(Although I guess it would have been easier to use htmlspecialchars(),
instead of writing an own function :) ).

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

Cheers
Steffen

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5278
    http://security-tracker.debian.net/tracker/CVE-2008-5278
[1] http://trac.wordpress.org/changeset?old_path=tags%2F2.6.3&old=&new_path=tags%2F2.6.5&new=#file2

Message #10 received at 507193@bugs.debian.org (full text, mbox, reply):

From: Andrea De Iacovo <andrea.de.iacovo@gmail.com>

To: Steffen Joeris <steffen.joeris@skolelinux.de>, 507193@bugs.debian.org

Subject: Re: Bug#507193: CVE-2008-5278: Cross-site scripting (XSS) vulnerability

Date: Sat, 29 Nov 2008 19:21:24 +0100

[Message part 1 (text/plain, inline)]

> Package: wordpress
> Severity: important
> Tags: security, patch
> 
> Hi,
> 
> the following CVE (Common Vulnerabilities & Exposures) id was
> published for wordpress.
> 
> CVE-2008-5278[0]:
> Cross-site scripting (XSS) vulnerability in the self_link function in
> in the RSS Feed Generator (wp-includes/feed.php) for WordPress before
> 2.6.5 allows remote attackers to inject arbitrary web script or HTML
> via the Host header (HTTP_HOST variable).
> 
> The upstream patch is here[1], look at the diff in wp-includes/feed.php.
> (Although I guess it would have been easier to use htmlspecialchars(),
> instead of writing an own function :) ).
> 
> If you fix the vulnerability please also make sure to include the
> CVE id in your changelog entry.

First of all thank you for reporting this.

Upstream's solution it's not so bad in my opinion. Moreover I think
using official patch should protect us from future bugs.

I'll have the new package ready for tomorrow.

Thank you again.

Cheers.

Andrea De Iacovo

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 507193@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Andrea De Iacovo <andrea.de.iacovo@gmail.com>

Cc: 507193@bugs.debian.org

Subject: Re: Bug#507193: CVE-2008-5278: Cross-site scripting (XSS) vulnerability

Date: Sat, 29 Nov 2008 23:18:11 +0100

[Message part 1 (text/plain, inline)]

Hi Andrea


> > If you fix the vulnerability please also make sure to include the
> > CVE id in your changelog entry.
>
> First of all thank you for reporting this.
>
> Upstream's solution it's not so bad in my opinion. Moreover I think
> using official patch should protect us from future bugs.
Don't get me wrong, I don't want to diverge from upstream, it's just that the 
php functions are the standard for taking care of such things and upstream 
should be taught to use them :)

> I'll have the new package ready for tomorrow.
Awesome, thanks for all your work with wordpress :)

Cheers
Steffen

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 507193@bugs.debian.org (full text, mbox, reply):

From: Andrea De Iacovo <andrea.de.iacovo@gmail.com>

To: Steffen Joeris <steffen.joeris@skolelinux.de>

Cc: 507193 <507193@bugs.debian.org>, Thijs Kinkhorst <thijs@debian.org>

Subject: Re: Bug#507193: CVE-2008-5278: Cross-site scripting (XSS) vulnerability

Date: Sun, 30 Nov 2008 12:33:00 +0100

[Message part 1 (text/plain, inline)]

New package ready.
http://www.firstbit.net/debian

Could you or Thijs (I'm ccing him) upload it?

Thanks a lot

Cheers.

Andrea

[signature.asc (application/pgp-signature, inline)]

Message #25 received at 507193@bugs.debian.org (full text, mbox, reply):

From: "Thijs Kinkhorst" <thijs@debian.org>

To: "Andrea De Iacovo" <andrea.de.iacovo@gmail.com>

Cc: "Steffen Joeris" <steffen.joeris@skolelinux.de>, "507193" <507193@bugs.debian.org>

Subject: Re: Bug#507193: CVE-2008-5278: Cross-site scripting (XSS) vulnerability

Date: Sun, 30 Nov 2008 12:46:03 +0100 (CET)

Hi Andrea,

On Sun, November 30, 2008 12:33, Andrea De Iacovo wrote:
> New package ready.
> http://www.firstbit.net/debian
>
>
> Could you or Thijs (I'm ccing him) upload it?

I have changed the urgency to high and uploaded it.
Thank you for your work.


Thijs

Message #30 received at 507193-close@bugs.debian.org (full text, mbox, reply):

From: Andrea De Iacovo <andrea.de.iacovo@gmail.com>

To: 507193-close@bugs.debian.org

Subject: Bug#507193: fixed in wordpress 2.5.1-11

Date: Sun, 30 Nov 2008 12:03:33 +0000

Source: wordpress
Source-Version: 2.5.1-11

We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive:

wordpress_2.5.1-11.diff.gz
  to pool/main/w/wordpress/wordpress_2.5.1-11.diff.gz
wordpress_2.5.1-11.dsc
  to pool/main/w/wordpress/wordpress_2.5.1-11.dsc
wordpress_2.5.1-11_all.deb
  to pool/main/w/wordpress/wordpress_2.5.1-11_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 507193@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrea De Iacovo <andrea.de.iacovo@gmail.com> (supplier of updated wordpress package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 30 Nov 2008 11:26:39 +0100
Source: wordpress
Binary: wordpress
Architecture: source all
Version: 2.5.1-11
Distribution: unstable
Urgency: high
Maintainer: Andrea De Iacovo <andrea.de.iacovo@gmail.com>
Changed-By: Andrea De Iacovo <andrea.de.iacovo@gmail.com>
Description: 
 wordpress  - weblog manager
Closes: 507193
Changes: 
 wordpress (2.5.1-11) unstable; urgency=high
 .
   * Added 011CVE2008-5278.patch. (Closes: #507193)
     Upstream patch for XSS in feed.php self_link function was
     implemented. (CVE-2008-5278)
Checksums-Sha1: 
 55562bb4c45131288d540bfa2b205b19f61f1e92 1315 wordpress_2.5.1-11.dsc
 921af6831317bca44d1f7f34469ad2e279570427 698118 wordpress_2.5.1-11.diff.gz
 6739df7753778129b28f01b78ade9140a1269798 1032134 wordpress_2.5.1-11_all.deb
Checksums-Sha256: 
 f8a94bf9c638ef2d1301be1ab858eb585b7378c84f0bf24d542af88eec8a0439 1315 wordpress_2.5.1-11.dsc
 dc7ba8af0f2c46f1b68ca9e790d9cbee8bd21e55cf932b5ef7eeb2c0c6b5ec24 698118 wordpress_2.5.1-11.diff.gz
 1864a1f00c848eda1903f13d2d03c6906b20dec5659e4a9c30776d5e86254e4f 1032134 wordpress_2.5.1-11_all.deb
Files: 
 e65becca5eb5d8d44fac3308e118f6f3 1315 web optional wordpress_2.5.1-11.dsc
 fe62a3cad1e93a74c883b2e8965ed172 698118 web optional wordpress_2.5.1-11.diff.gz
 cdc86192b85e96c3b7e47ad53b3af607 1032134 web optional wordpress_2.5.1-11_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJJMnwNAAoJEGz0hbPcukPfhlwH/2aPIHd5Gx1BN7WW15iVIbYo
MhtWeTa8QSds/5fSq4dwItk/wIp/orG8tAFzLSA3yRpcYGT9cPJP4iQxX++5hQOZ
1Z1FkBYUfx+AKovPNVtDscYsrQeNGbi+IUhG7609F3zZ228iM/fh4D9HPC5X/4Ji
5gQEOZHErvB7ISBUvhU6TeaDu+KLflUiwliOIfbT+TYZi40kIy3YrZ2qKueZ1W1H
zr8/2dHz6HuG+4MIJRprd24guJ3zEMqAC6FBREiW44XLr9cDRzMEiISwRAtlMR4B
O+6AZAyxjeqvQDpcOmoIIqHZq7HCMs9bEkcDp/uH5qKYdjdo5+70xTDjx52PB+8=
=2rkM
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.